End-to-end encrypted secret sharing. Zero trust required.

Send passwords, API keys, and sensitive text to anyone — encrypted in your browser before it ever touches a server. The passphrase never leaves your device.

🔗 Try it live

Why This Is Trustworthy

Most secret-sharing tools ask you to trust that the server isn't logging your data. This one doesn't. Here's why:

Every line of source code is public. This app is built on Val Town, where the code that runs the server is the code you can read — no hidden build steps, no compiled bundles, no deploy pipeline that could inject anything. What you see at stevekrouse/secret-share is exactly what runs when you use the app.

That means you can verify:

✅ The passphrase is never sent to the server — check client/app.tsx and shared/crypto.ts
✅ The server only stores ciphertext, IV, and salt — check server/db.ts
✅ The API never receives or returns plaintext — check main.ts
✅ Encryption uses AES-256-GCM with PBKDF2 key derivation (600K iterations, SHA-256) via the Web Crypto API — no homebrew crypto
✅ The client-side code served to your browser is the same source file from this repo, transpiled by esm.town with no bundler in between

Even the app's author cannot read your secrets. The database contains only encrypted noise without the passphrase.

How It Works

Rendering mermaid diagram...

Security Model

Layer	Detail
Encryption	AES-256-GCM (authenticated encryption)
Key Derivation	PBKDF2 with SHA-256, 600,000 iterations
Salt	128-bit random per secret
IV	96-bit random per secret
Passphrase	User-supplied or auto-generated, never transmitted
Server storage	Ciphertext + IV + salt only — no plaintext, no passphrase, no key material
Expiry	Configurable: 1 hour → 30 days (default 1 week)
Deletion	Receiver can destroy immediately after reading

Project Structure

secret-share/
├── main.ts              # Hono HTTP routes + API endpoints
├── server/
│   ├── db.ts            # SQLite CRUD (stores only ciphertext)
│   └── render.tsx       # Server-side React rendering
├── client/
│   ├── app.tsx          # React UI (create + reveal views)
│   └── hydrate.tsx      # Client-side hydration
└── shared/
    ├── types.ts         # Shared TypeScript interfaces
    └── crypto.ts        # AES-256-GCM encrypt/decrypt (Web Crypto API)

Tech Stack

Runtime: Val Town (Deno)
Server: Hono
UI: React 18 (SSR + hydration, JSX only — no HTML/CSS/JS strings)
Styling: Twind (Tailwind-in-JS)
Database: Val Town SQLite
Crypto: Web Crypto API (built into every modern browser and Deno)

Usage

Create: Enter your secret → passphrase is auto-generated (or type your own) → click "Encrypt & Create Link"
Share: Copy the link and passphrase — send them via different channels (e.g. link in Slack, passphrase in a text message)
Receive: Open the link → enter the passphrase → read the secret
Destroy: Click "Delete This Secret Now" to remove it before expiry